assigning a unique security group to each machine uses up security group quotas in HPCloud (openstack)

I think this is a great idea.

There are issues with doing this though. Juju de-couples the machine creation from the purposing of the machine. One can remove a service from a machine, and add another to any machine right now.

Bug #833064 suggests doing the firewall inside the machine using iptables. I think that may be a more flexible approach.

Either way, the bug here is not a "should" but rather juju runs into HPCloud's security group quotas.

another option might be to enable group per service via a service constraint. machines associated to the service would not be subject to independent reuse though.

Excerpts from Kapil Thangavelu's message of 2012-07-23 16:11:32 UTC:
> another option might be to enable group per service via a service
> constraint. machines associated to the service would not be subject to
> independent reuse though.
>

+1 this is a great idea, and should be fairly simple to implement.

Hi Frank,

Is this still an issue for juju-core ?

Dave

Today juju-core supports port control per instance or global, not yet per service. AFAIK it's not planned per service, but the mentioned one using iptables. Gustavo, am I still right here?

It may be useful to know that according to HP, the hard limit on security groups is 100, and you have to fill in forms and apply for permission to use any more than 10...

As far as I am aware this is fixed: you should be able to set "firewall-mode: global" in environments.yaml to work around this limitation. It's not great -- any open port for any exposed service will be opened on all machines -- but it works around this limitation, so long as you start the environment in this mode (you can't change it in a running environment, sadly).

Service security groups play merry hell with the density story we're currently focused on, so they're not something we're considering at the moment. I think the long-term answer will be per-machine iptables rules (which will be helpful everywhere) in combination with an always-global-mode firewaller.